Slashdot videos: Now with more Slashdot!

View

Discuss

Share

We've improved Slashdot's video section; now you can view our video interviews, product close-ups and site visits with all the usual Slashdot options to comment, share, etc. No more walled garden! It's a work in progress -- we hope you'll check it out (Learn more about the recent updates).

An anonymous reader writes "Two iPhone App developers have spotted what appears to be a hacking of the App store rankings by a rogue developer. The rankings in the books category of the US iTunes store features 40 out of 50 apps by the same app developer, Thuat Nguyen. What's more concerning is that it seems individuals' iTunes accounts have been hacked to make mass purchases of that one developer's apps." Among the comments attached to the linked story is one which suggests the security problem may lie elsewhere.

Perhaps this is just another reason why I don't use iTunes. If I like an artist I download, I'll buy their CD - if not, I delete it. And makes it much easier to convert a CD to ogg or flacs than with a lot of their Apple's AAC crap.

Jobs doesn't care as long as he can by another yacht. Someone will mod this troll because they are an apple fanboy. But the truth is he is as unscrupulous as Balmer, Larry Ellison, and a world of corporations and lawyers. Apple, just like the rest, will only do as little as they need to as long as they have a bunch of sheep willing to buy whatever he trots out on stage next.

I fail to see what relevance Apple (much less Steve Jobs personally) has here. This is about hacked user accounts. This kind of thing is an unfortunate fact of life, keeping in mind that social engineering attacks take up the majority in security breaches. There's only so much Apple can do to mitigate this, and I don't see that they missed anything.

Heck, if anything, Apple's "walled garden" model - for all my dislike of it - is most efficient at dealing with these kinds of abuses. When malware authors have to go to the effort of hacking user accounts to get their crap shoved at users, you know they're tight against the wall already. In comparison, with Android, you just call yourself "Googe" (note spelling) and upload your malware directly [androlib.com].

(How do I know it's malware? I haven't installed it, of course - but when all their apps, including a non-multiplayer five-in-a-row game, request "full network connectivity" and "location information" permissions on install, you know something's fishy; the fake company name is just icing on the cake.)

The irony is that I can't even use Market feature to report it as malware, or at least write a 1-star review with a warning, because you can only write reviews/complaints once you install the app...

How about Apple look at your account, notice you live in Bumfark, IA, and not allow logins from IPs outside of the US unless you provide additional authentication or they send an SMS to your phone and you have to provide the code?

Full network connectivity is required for downloading advertisements, which are required to keep many of the apps free. You can buy any app you choose, and many will not come with advertisements. Location information comes in two types: Course (GSM antenna triangulation) and Fine (GPS), presumably to serve you targeted advertising. You can turn off data connections and use the app, then if you wish remove it before reconnecting.

I have, however, spotted some free games on the Android Market which require th

Jobs doesn't care as long as he can by another yacht. Someone will mod this troll because they are an apple fanboy. But the truth is he is as unscrupulous as Balmer, Larry Ellison, and a world of corporations and lawyers. Apple, just like the rest, will only do as little as they need to as long as they have a bunch of sheep willing to buy whatever he trots out on stage next.

To those who disagree, consider, Christianity defines greed as a sin. The Republican party supports Fundamentalist Christianity. So the Republican party defines greed as a sin. Therefore, the Republican party is Communist!

It's kind of like blaming Blizzard for people's WoW accounts getting hacked. Your account has something someone wants, they'll try to get it. If you use weak passwords, well, no one's fault but your own there.

Except Blizzard has a track record of account restoration and decent customer service in this area.

In reality, most of the time it's neither party's fault -- The recent Adobe Flash exploit hurt a lot of people as they targeted flash advertisements for wow websites... even legitimate websites could be infected as they have to show advertisements to stay in business.

Thankfully, Blizzard realizes that blaming end-users when a large, large percentage did not 'ask' for it, only costs the company money in the end when users stop using their service.

Like the poster above said, sometimes its neither. My brothers Gmail was hacked during the big Chinese Google hacking debacle. His WoW account was then compromised. Thankfully he has a G1 phone and saw the change password notification email on his phone and put a quick stop to it. Blizzard restored everything and he now has the little FOB thing with the LCD screen. And he changed all his account passwords (he uses very strong completely random passwords). Hasn't had a problem since.

From Terms and conditions, security section:
"You are entirely responsible for all activities that occur on or through your Account, and you agree to immediately notify Apple of any unauthorized use of your Account or any other breach of security. Apple shall not be responsible for any losses arising out of the unauthorized use of your Account. "

So better hope something else protects those people harmed, as I don't think California law (The "fall back" for iTunes T&C) will help much if a hacker steals $100-300 from you from another country.

Glad I stopped storing my CC info with iTunes after they pulled products I paid for from the store and wouldn't let me re-download. They may have nice hardware, but their policies are horrible for end-users.

Other problem with iTunes,
"All sales are final."....
From Terms and conditions, security section:
"You are entirely responsible for all activities that occur on or through your Account, and you agree to immediately notify Apple of any unauthorized use of your Account or any other breach of security. Apple shall not be responsible for any losses arising out of the unauthorized use of your Account. "

"You are still responsible for your entire purchase. The FTC Will not force your card company to refund you (Letter of the law does not require it). If you notify your card company you are responsible for the first $50 in charges -- YOUR CARD COMPANY MAY be kinder, but the LAW does not require it."

You might want to read the FTC site. Your liability is zero if the charge involves your CC number rather than your actual card.

And quick follow up to my post:
You have 2 business days from the time Apple sends you an e-mail to notify your bank/credit provider.
After 2 business days from the e-mail, you are liable for $50 if you linked a credit card, and $500 if you linked a debit card.

You *may* have additional protections depending on your issuer, however expect none, go remove your credit card info from apple's server now, change your password, and wait until you need to do another purchase to put it back on at least.

Some banks / credit cards allow you to generate temporary credit card numbers with a limit that you specify. The ones I've seen in use also tie themselves to the first vendor they are used with. The temporary credit card number is effectively an alias for your real number. Personally I think these temporary numbers are far better to use online than a real credit card number.

BTW, Slashdot has an automatic signature feature, which gives you two benefits: you don't have to add it manually after each post, and those readers who aren't interested in the clutter of signtures can turn them off. When you add it manually, you annoy the latter group.

If by "nice" you mean it looks nice and feels slick then I agree but my Apple hardware has been much less reliable than other stuff. Seems to be the case with everyone I know that owns Apple hardware. The fans seem to ignore it though even though they wouldn't on non-Apple hardware. Reality distortion field indeed.

I do use iTunes and the level of reviews are generally so crap as to be useless anyway. They tend to either be "this crashed on me once, 1 star" or "AWESOME!!! 5 stars!". That's not even mentioning the frequent "I don't want to buy this app because it looks crap, 1 star" reviews that seem to pop up and aim to be even more useless.

It does deserve to be noted as a colossal mistake to have allowed reviews by people who hadn't even downloaded a given app.

When SuperMonkeyBall was released, there were over 3,000 reviews. The average star rating was a high 4. I paid $9 for it and found out it was a horrible port with horrible controls and actually sucked. Then I read the reviews and they were mostly from iTunes users who were fans of the console version of the game and wanted to mouth off about how great it is. Few of them had actually

Out of interest (and because you seem like a rational debater), could you enlighten me on the subject of the Apple app store's rating system? I'm an Android user myself, and I don't know how things are in Apple land. In the Android Market, you can rate apps with 1-5 stars (1 being 'poor', 3 being 'average', and 5 being 'excellent').

You see, I would like to investigate if app stores could be better compared on quality rather than quantity. It seems to me that it would be better to have one thousand apps with

Out of interest (and because you seem like a rational debater), could you enlighten me on the subject of the Apple app store's rating system? I'm an Android user myself, and I don't know how things are in Apple land. In the Android Market, you can rate apps with 1-5 stars (1 being 'poor', 3 being 'average', and 5 being 'excellent').

It works the same on the iTunes App Store. A 1-5 star rating. I don't know of a site that calculates an average rating for the entire store.

Ratings on the Android market place seem to be even worse than those described above for the Apple app store. I frequently see people giving apps one star because it crashed on their phone, even though their phone is often either not on the supported list (usually because it lacks the resources to handle said app), or even if the developer specifically states that it doesn't work on handset X for reasons a, b and c. Alternately I see spammers everywhere giving five stars but not because they've even used the app, just because they want to post a link to their website in the comments. I'll always use proper app review sites to determine which apps are actually worth using - the reviews on the market place are worse than useless.

In fact, the whole filtering of the market place is one of the few disappointments with my HTC - I don't know if this is because people are expected to go online to search, but there are just too few options. I can either search on top rated (which is split into paid and free, but is rubbish for the reasons I've already stated) or "just in", which I assume is ordered by timestamp, but is a mix of free and paid and seems to be useless anyway because it doesn't order by the original release date of the app, but rather by the last version update - so you end up with the position that apps are being updated several times a week, I don't know if this is a cynical move to stay at the top of the "just in" list or if these apps really are being updated for the better, but either way it has the same result on finding anything.

And don't even get me started on the millions of useless screensaver/wallpaper/soundboard/etc apps. Why release one app which allows users to select from 1,000 different wallpapers using a web service when you can just package them as 1,000 different apps each with only 1 wallpaper and flood the hell out of the market place? Ugh, indeed.

I frequently see people giving apps one star because it crashed on their phone, even though their phone is often either not on the supported list (usually because it lacks the resources to handle said app), or even if the developer specifically states that it doesn't work on handset X

In that case, the developer is still at fault for not specifying the proper prerequisites in the project manifest. If handset X can't handle the app, it should not be listed in the first place. (Of course, the process can be circumvented by handing around APK's manually.)

Alternately I see spammers everywhere giving five stars but not because they've even used the app, just because they want to post a link to their website in the comments.

This is a true problem, I agree. One aspect of the problem is that it's too cumbersome to individually mark each such occurrence as spam (one might envision stripping comments for links and link-like content, but it's not there yet).

In fact, the whole filtering of the market place is one of the few disappointments with my HTC

In both app stores, the vendors apparently need to really improve the presentation of apps. Sorting by rating would be a VERY nice feature in the Apple App Store, for instance.

But in both cases, if they are going to provide a proper infrastructure for selling mobile phone software, the consumers and developers would both benefit hugely by better categorization, sorting, and filtering of search results.

I do use iTunes and the level of reviews are generally so crap as to be useless anyway. They tend to either be "this crashed on me once, 1 star" or "AWESOME!!! 5 stars!". That's not even mentioning the frequent "I don't want to buy this app because it looks crap, 1 star" reviews that seem to pop up and aim to be even more useless.

As a side note, that's almost exactly like in Android Market - with the sole difference that you can't write a review there without installing the app, so you don't have "didn't buy, 1 star". The rest is spot on.

However, because many of the apps are free (and even the paid ones you can get a full refund if you uninstall within 24 hours, IIRC) you end up with insane amounts of comment spam, "Great app, for many more visit my site at..." posted on every single app that gets released.

Do you pay for everything with cash? And, I mean _everything_. No, really - you do realize that this situation is not unique to iTunes, right? Hackers could go after your Amazon account, your Hydro account, or even your bank account. If the information is stored on a computer, hackers can (and have) found ways to go after it. It is not unique to iTunes.

If you don't like iTunes (as you clearly don't), just don't use it because you don't like it - there's no need to make up excuses. Otherwise, back it up a

I tried that approach a few years ago (pay everything in cash)... only problem was I needed a bank account to cash my paycheque... So that's all I had it for... to put the cheque in, and remove the cash right after. Worked great... until I tried to get car insurance for a car that I paid for in cash... apparently I had no credit history and therefor was a high risk to insure.

So I hacked the credit application database and gave myself great credit.... umm... where was I going with this... ???

I doubt very much that's an American thing. If you don't have any debt, as in no loans, CC etc., then they don't know how to rate your risk. Which doesn't make you high risk so much as an unknown. Which for reasons related to prudence mean that any lender should eye such a person with caution.

Maybe it's due to our "special relationship" with the US, but certainly here in the UK if you have no history of good credit repayments (store card, credit card, overdraft or loan repayments) it's incredibly difficult to get finance for large purchases, and next to impossible to get something like a mortgage. Ironically, someone with zero debt who has never owned a credit or store card or taken out loans and believes in paying for everything in full, in cash, would have to use the same high interest company

We do have secured credit cards here, where you have to put down collateral in order to borrow. But the problem is that it's your money in the bank account. Whereas you're asking to borrow their money.

Compare reporting fraud on an ATM card versus on a CC in the US and you'd see what I mean. Because it's their money with a CC the anti-fraud measures tend to be much more significant than an an ATM card where it's your money, not theirs.

A lot of these people seem to come across as "tech savvy". So - why do they have their primary credit card accounts linked to the app store? I have one debit card that I use online. Guess what? It's almost always EMPTY. Balance of zero. No cash onhand. DEBIT cards can't be used to make mass purchases when there is no balance on them. Each week, when I get my pay, I pretty much know what I want to purchase online - I just deposit enough to cover those purchases, and a dollar or two more.

Of course not - what I'm saying is that if you're going to scam a lot of people, a short workweek is the best time to do it. People are making their vacation plans, you've got the long weekend before the head honchos will deal with it, etc.

Last month, a user posted a forum comment stating, "I am going to tell you the truth about what has been going on with your account." The anonymous user then explained, "let’s say you are a Chinese guy or girl with an iPhone or iPad and you want to get some music, movie or app. How you do you do it? You go to http://www.taobao.com/ [taobao.com] The (by far) largest online market in the world and type iTunes in the search bar. Immediately you will be presented with a list of more than 7,000 items.

"You want to save money, so you filter the list to show only items under RMB25.00- (US $3.60) and still you have more than 3,600 offers. So you pick some one at random like, as an example, this one: http://item.taobao.com/item.htm?id=5516054242 [taobao.com]. You open the online chat and you transfer him RMB22.00 (US $3.20). He ask you in the online chat to provide a new iTunes account name and password, and you comply: User: qiuwge3foe3333@yahoo.com Password: qwer34567

"He asks you to wait 10 minutes online. He has already a number of user accounts under surveillance, so he enters in the iTunes account of his victim, change his/her username and password to the one you provided, and come back to ask you try it and approve the transaction so Taobao.com releases his money. Even if you cant read Chinese you can see very clearly in his item description that this account will not last more than 24 hours (the time for his victim to see the charges mounting and then cancel the credit card).

"He claims that he selects 'his' accounts so you can drain at least US $250.00 from them before they get cancelled. He urges you to be fast and buy and download as fast as you can. Start immediately! Keep the download going on for the full 24 hours! There is no warranties on how long it will last! Because he already changed the username and password, the victim can’t stop you.

More details here [appleinsider.com] though so far there's no explanation of how the accounts are getting hacked.

More details here though so far there's no explanation of how the accounts are getting hacked.

It's not hard to guess: Average people use the same password for just about everything, or simple permutations of the same password. Get access to any source that the user entered a password for, gain access to everything else.

This is why you only use pre-paid gift cards that you can buy anywhere. Usually once a month I'll get a $15 or $25 refill while at the checkout line at walmart or the grocery store and fill up my iTunes account.

Yep. Email for you: "Secure your iTunes account now...All iTunes customers are encouraged to log on to their account and change their passwords now. CLICK HERE TO GO TO THE SECURE WEBSITE. Enter your personal info and we will make sure you are protected...blah blah"

I hate to think that 20 years from now we will still have people all around the world falling victim to phishing. Everyday I get princes and princesses from all around the world that need my help in transferring millions of dollars to the US

Eh, not just that, I got a call the other day from US Pharmacy, wanting to know about my Xanax prescription. I don't take Xanax and a quick google revealed it to be a phishing scam wherein they eventually ask for your CC number to supposedly look up the account information. Of course, I hung up when he wouldn't admit that I don't have a prescription for that from them.

It is not phishing, it is something worse. Some Apple guy told a friend "change your password immediately" when he contacted them regarding 4-5 apps he didn't actually buy showing up on his order history.

It really sounded like some "password stolen" issue to me but I really doubt it is phishing as I know the guy, not a type who will be a phishing victim.

Note that it is a theory only, I don't have the actual data nor I am an iPhone customer.

It's most likely that the app itself is asking for the iTunes username and password. This could nominally be for an in-game purchase, or it could be prompting claiming it was for some other reason, such as "activating the application", where people are willing to put in the information because they've already thrown money at the application. Or it could just be asking for them with no reason given.

It's really hard to avoid this kind of trojaning, if it's either time acti

This is a Problem In Chair Not In Computer problem. If users are stupid enough to respond to the iTunes phishing scams that circulate then they shouldn't be surprised when someone uses their details.

My suggestions:1. Report any fraudulent transactions to your credit card company/bank so the transactions are stopped. And get your card cancelled.2. Login and choose a secure password morons

But with your average person the problem is in the chair. You can give lots of good advice, but the market is still going to be corrupt because it provides avenues for theft. A corrupt market is bad for all of us.

A corrupt market is bad for the security conscious. For everyone else, they're probably willing to accept that they pay a little more for everything to cover the cost of the losses because it means they can jump through fewer security hoops to do anything. It's the people who would gladly jump through those hoops but aren't being given the opportunity that are really losing out so that everyone else can be lax - maybe a two-tier system where you can get some return on being less of a security risk would hel

I've seen a lot of Passwords "Stolen" over the last few weeks -- likely the adobe bug, or another vulnerability.

If your password is "!!Hell0Kitty77KeRt*?Captain" it can be stolen just as easily as any insecure password.

And in the case of Adobe / in-advertisement trojans, you can't really blame the end user for using programs that are almost 'required' nowadays to actually use websites. To expect end-users to know enough about IT security as

The exact same thing used to happen (and possibly still does) with PalmOS apps and the associated online stores. Certain developers, mostly asian-based, would create very basic, sometimes useless apps, and list them on stores like Handango for low, low prices. Then they'd suddenly skyrocket in the listings. If you grabbed a demo version, you could see that a lot of these applications were complete duplicates with just the name changed. They'd bank on some legit sales once the app was ranked, but boost their

After reading the article, the other linked article, and the comments posted on the linked site, I have to ask what's more likely here: that approximately 30 people out of 100+ millions of iTunes users have infected systems with key-loggers and were phished, or that the App Store has some huge security problem?

Would 30 people out of 100+ million really be able to sway the App store so much that the targetted apps would account for 40 of the top 50 apps? I don't disagree that the mostly likely explanation is people with infected systems or people subject to phishing attacks, but it's patently a hell of a lot more widespread than you're suggesting.

Apple doesn't care. Even if it was 100% their problem.They don't care.There are currently apps on the app store which are fake. They aren't as described. I grabbed one of them when they had a "Free" day. They're described as epic stickman fighting games. But the screenshots bear no resemblance to what the description is and feature no UI. They're filed under games, but feature no gameplay. They are all the same 4 low res stickman videos they pulled off some site.There are several copies of this app with different names. They've all been reported multiple times but apple has not removed them, made them change the description or even categorize them appropriately.

1. Rogue developer writes crap app and gets in App Store
2. Rogue developer hacks iTunes account and purchases his own app with it
3. Apple charges hacked account and transfers funds to rogue developer
4. Hackee finds out he's been ripped off and has to fight with Apple for refund

Solution: Replace step 3 with: Apple transfers funds for untrusted developers to an escrow account for 30 days before paying out. A developer can become trusted after a set amount of

Ignoring the 'X OS is more secure then Y OS' debate, nothing is immune to being hacked. It just takes times and a desire. Like every system, if someone wants to break into it enough then they will find a way. Something like this would have been a targeted attack which pretty much makes any normal security moot since the way it was done would have been unique to this system. Its a tailor-made attack and nothing short of disconnecting the iTunes server could have prevented it.